Mailbox-level control refers to administrative settings that allow an organization to enable or disable webmail access for individual mailboxes. In Microsoft Exchange and similar systems, this can mean blocking Outlook on the web for specific accounts while leaving other mailbox functions, such as desktop or mobile client access, unchanged.
This matters because webmail is often exposed to the internet and is a common target for password theft, session hijacking, and web application exploits. By turning off webmail for accounts that do not need it, defenders reduce the attack surface and limit the number of accounts an attacker can abuse after gaining access. In attacks, mailbox-level control may be bypassed or changed if an intruder reaches administrative settings, so teams should monitor configuration changes, review which accounts need browser access, and use the setting as part of a broader access-control policy.